asyncrat

General

Target

d9ec2e333a48365878a8fe44e287111e73e43a8314ab717bfd20f9ef1bde9afc
Size

3.6MB
Sample

230111-y1rt1sab3s
MD5

7fee70edac93dbec8a5a602b33b97d0b
SHA1

f9595e9e4572dd068a70502faf7717328d8d30ca
SHA256

d9ec2e333a48365878a8fe44e287111e73e43a8314ab717bfd20f9ef1bde9afc
SHA512

f04c2457c481ff0ea7de2f0d7bb690ebc0a24d5eebb997075ded14ef0d34becc3d045ab1d57a27657bc85fef3031e5bb7e62548ce3c4e26d3596f16a657c982f
SSDEEP

98304:aQU/QvsjfLP3L4LP1TRDLPo6oELPb/wULPXFLPp:aQjsjff4ZpjvPZxt

Score

10^/10

Malware Config

Extracted

Family

darkcomet

Botnet

New-July-July4-01

C2

dgorijan20785.hopto.org:35800

Mutex

DC_MUTEX-U4BEN1Z

Attributes

gencode
8sAQdbHcGDto
install
false
offline_keylogger
true
password
hhhhhh
persistence
false

Extracted

Family

warzonerat

C2

45.74.4.244:5199

dgorijan20785.hopto.org:5199

Extracted

Family

darkcomet

Botnet

New-July-July4-0

C2

45.74.4.244:35800

Mutex

DC_MUTEX-RT27KF0

Attributes

gencode
cKUHbX2GsGhs
install
false
offline_keylogger
true
password
hhhhhh
persistence
false

Extracted

Family

asyncrat

Version

0.5.6A

C2

45.74.4.244:6606

45.74.4.244:7707

45.74.4.244:8808

Mutex

servtle284

Attributes

delay
5
install
true
install_file
wintskl.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  
  d9ec2e333a48365878a8fe44e287111e73e43a8314ab717bfd20f9ef1bde9afc
- Size
  
  3.6MB
- MD5
  
  7fee70edac93dbec8a5a602b33b97d0b
- SHA1
  
  f9595e9e4572dd068a70502faf7717328d8d30ca
- SHA256
  
  d9ec2e333a48365878a8fe44e287111e73e43a8314ab717bfd20f9ef1bde9afc
- SHA512
  
  f04c2457c481ff0ea7de2f0d7bb690ebc0a24d5eebb997075ded14ef0d34becc3d045ab1d57a27657bc85fef3031e5bb7e62548ce3c4e26d3596f16a657c982f
- SSDEEP
  
  98304:aQU/QvsjfLP3L4LP1TRDLPo6oELPb/wULPXFLPp:aQjsjff4ZpjvPZxt
Score

10^/10

darkcomet warzonerat new-july-july4-0 infostealer rat trojan upx asyncrat persistence
- AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers.
  rat asyncrat
- Darkcomet
  DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
  trojan rat darkcomet
- WarzoneRat, AveMaria
  WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
  rat infostealer warzonerat
- Async RAT payload
  rat
- Warzone RAT payload
  rat
- Drops file in Drivers directory
- Executes dropped EXE
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2